Italy implements EU Whistleblower Directive: the new obligations for companies

By Legislative Decree no. 24/2023, published on the Gazzetta Ufficiale on 15 March 2023 (“Decree”), Italy has finally implemented the EU Directive on whistleblowing.

The new regulation establishes a comprehensive legal framework for the protection of individuals who report violations of national or EU law that jeopardize public interests or the integrity of public or private entities.

The new rules aim to promote transparency and accountability and make whistleblowing a crucial tool to prevent criminal activities and breaches of national and EU law, also for companies operating in the private sector.

Below is a summary of the key provisions of the Decree concerning private-sector companies.

• Companies with at least 50 employees, those who have adopted a compliance program under Legislative Decree no. 231/2001 and those operating in specific industrial sectors (regardless of the number of employees) must establish an internal whistleblowing system that guarantees the confidentiality of the reporting person's identity, any third parties involved, the circumstances mentioned in the report and the related documents.
• Depending on the characteristics of the company, the internal whistleblowing system must enable the reporting of wide range of misconducts, including breaches of EU law, violation of Legislative Decree no. 231/2001 and of the compliance program (if adopted).
• Reporting can be done in writing or orally, or both. Oral reporting may be made by phone or through voice messaging systems, and, upon the reporting person's request, by an in-person meeting within a reasonable timeframe.
• Companies with up to 249 employees may share internal reporting channels.
• The internal channels must be managed by an autonomous internal person or department (with specially trained personnel) or by a qualified external person or department, with the same requirements.
• The designated department (or person) responsible for managing the internal channel must process the report with specific procedures and timing (e.g., acknowledge receipt of the report to the reporting person within seven days, interact with the reporting person and request additional information if necessary, and provide the reporting person with a follow-up on their report within three months).
• Companies must provide accessible information on the channels, procedures, and prerequisites for submitting internal and external reports, which must be published on the company's website.
• Reports can be submitted externally to the National Anti-Corruption Authority (ANAC) in specific cases. For example, if internal reporting has not been followed up or if the internal channel does not comply with the Decree.
• The Decree strengthens the prohibition of retaliation measures against the reporting person.
• ANAC may apply penalties ranging from €10,000 to €50,000 for various violations, such as retaliation against the reporting person, failure or inadequate activation of internal reporting channels, or failure to investigate the circumstances mentioned in the reports.

What's next?

The new provisions will come into effect on 15 July 2023. Companies that have employed an average of up to 249 employees in the past year will be required to implement their internal channel starting from 17 December 2023.

In the months leading up to the entry into force of the Decree, companies subject to the new provisions will need to establish internal reporting channels or, if already implemented, verify that the existing systems and company policies on whistleblowing, including at the group level, comply with the requirements set forth in the Decree. In case of non-compliance with these requirements, the whistleblowing systems will need to be adapted to ensure compliance with the new parameters and minimize the risks associated with non-compliance, including the sanctions provided for by the Decree.

The Investigations, White Collar & Fraud team is available for any clarifications or further information regarding the Decree and the scope of the new obligations.

Authored by Francesca Rolla, Alessandro Borrello, and Vincenzo Donadio.